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A communication protocol is introduced that allows the receiver of a message to place an a poste- 
riori bound on the amount of information that an eavesdropper could have obtained during trans- 
mission of that message. This quantum cryptographic protocol is distinct from quantum key distri- 
bution. The quantum states and measurements required by this protocol are simple enough that it 
can be implemented using existing technology. 
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A major concern when transmitting a secret message 
over a public communication channel is that an eaves- 
dropper might intercept the message and learn its mean- 
ing. This is combatted by encrypting the message so that 
an eavesdropper cannot decipher the meaning of the in- 
tercepted message. [1, 2] In its most secure form, this re- 
lies upon the communicating parties sharing a single-use 
private key which is as long as the message. [1] Recently, 
great strides have been made at generating and distribut- 
ing private keys using quantum mechanical systems sent 
through insecure channels. [3] Such quantum key genera- 
tion (QKD) protocols have the distinct feature that an 
eavesdropper leaves evidence of her activity. However, 
due to their design, these QKD protocols do not convey 
messages. 

In this Letter we introduce a quantum seal protocol, 
which is a method for two parties to communicate a mes- 
sage, not simply to generate a random key. [4, 5] Its utility 
comes from the fact that it allows the receiver to place 
an a posteriori bound on the amount of information an 
eavesdropper could have obtained over the course of the 
transmission. Each time a message is sent, there is a 
straightforward way in which an eavesdropper can at- 
tempt to intercept the message. Yet if this occurs, the 
receiver will be given an unambiguous indication that 
there was a disturbance in the system and an eavesdrop- 
per may have been tapping into the communication chan- 
nel. If there is no eavesdropper and the quantum channel 
is relatively noise-free, then the receiver will have confi- 
dence that no other parties have read the message. 

This protocol can be used to seal up and communicate 
an encrypted message, thereby providing an extra layer of 
assurance while sending sensitive material, on top of any 
sophisticated encryption technique that may currently be 
used. 

The protocol involves a message sender, named Alice, 
trying to get a message bit b (whose values can be zero 
or one) to a receiver, called Bob. The entire process 
is initiated by Alice announcing that she has a message 
she wants to communicate to Bob. Then a routine is 
repeated many times. Each repetition is referred to as a 
single "shot" , and proceeds as follows. 

Bob starts the routine by preparing some physical sys- 



TABLE I: Each shot, Alice makes one of the following eight 
announcements. 



Bit- Announcements 


Result- Announcements 


cri 


c = 




m = +1 




c = 1 




m — —1 


0"3 


c = 


0-3 


m = -f-l 


0-3 


c = 1 


0-3 


m — —1 



tem (which we refer to as a particle) in one of four quan- 
tum states, represented by density matrices p^"^ = |0)(0|, 
= pM ^ |+)(+|, or p(-) EE \-){-\. (Here 

we have used the standard notation for a qubit Hilbert 
space that is spanned by basis vectors |0) and |1) and 
|±) = 2^2 [|0)±|1)].) Bob employs a randomized method 
of preparation so that he is equally likely to prepare the 
particle in any of these four states. Bob records which 
state he has prepared and sends the particle to Alice. 

Upon receipt of the particle, Alice makes one of two 
measurements: with probability one-half she makes a 
measurement corresponding to cri = |+)(+| — 
and with probability one-half she makes a measurement 
corresponding to 0-3 = |0)(0| — Ahce records her 

measurement result as m (which will be -1-1 or —1) and 
announces whether her measurement corresponded to ai 
or 0-3. 

Then Alice makes a second announcement. With prob- 
ability Pa she announces the classical bit c which is de- 
termined from the message bit b and the measurement 
result m using 



- 6 



1 — m 



mod 2 



(1) 



which we refer to as a hit- announcement. Or else, (with 
probability [1 —pa\) she announces the value of m, which 
we refer to as a result- announcement. This completes the 
routine for a single shot. 

Each time that Alice makes a bit-announcement Bob 
has a chance to determine the value of 6, provided that he 
has prepared the particle in an eigenstate of the measure- 
ment operator corresponding to the measurement that 
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Alice performs. In such a case, Bob uses his conjectured 
value of TO (based on his knowledge of the state he pre- 
pared and his knowledge of the measurement made by 
Alice) along with the equation 

b = ^c+^-^^ mod 2 (2) 

to determine the value of b. Bob can only do this 
when the state in which he prepares the particle and 
the measurement that Alice performs have a "matching 
basis," which occurs with probability Pa/2- If a bit- 
announcement is made on a shot when Alice and Bob 
do not have a matching basis then Bob will not know 
which value of m to use in order to calculate the value 
of b. Similarly, since every outside observer lacks Bob's 
knowledge of the state in which he prepared the particle, 
both values of to are equally likely (for either measure- 
ment). An eavesdropper who is simply listening to the 
announcements made by Alice will not be able to deter- 
mine the value of the message bit b. (The analysis below 
provides a rigorous method to support this last heuristic 
statement.) 

In order to have a good chance that their bases will be 
matched up at least once on a bit- announcement. Bob 
and Alice will repeat this routine TV times, where the 
value of N can be chosen in the following way. They set 
some target confidence level Cm, where < Cm < 1, 
and choose N so that the probability of matching bases 
during a bit- announcement will be at least Cm- This 
leads to the value of A'' which is the next integer greater 
than log(l — C„,,)/log(l —pa/2). (This ignores the likeli- 
hood that some of the particles will not reach Alice due 
to imperfections in the quantum channel. This can be 
thought of as a "null" announcement by Alice and simply 
increases the number of shots that Bob needs to initiate 
in order to reach the target confidence level.) 

Each time that Alice makes a result- announcement it 
gives Bob an opportunity to test the quantum channel for 
noise (which may be due to imperfections in the system or 
an eavesdropper) . Since Bob knows the state in which he 
prepared the particle (for each shot), a statistical analysis 
of the measurement results allows him to determine if the 
state of the particle is being changed after it leaves him 
but before it is measured by Alice. 

Bob expects to have {l—pa)N, opportunities to check 
the measurement results; as pa becomes very small, this 
grows as - log(l - Cm)[2/pa - 5/2 + llpa/24 + 0{pa)% 
(Using the value of N determined earlier.) On the other 
hand, the number of bit- announcements (each of which 
provides an opportunity for an eavesdropper, called Eve, 
to gain knowledge of b) is expected to be PaN; as Pa 
becomes very small, this only goes like — log(l — Cm) [2 — 
Pa/2 — 0{pa)^]- Of course, Alice and Bob are free to set 
Pa as close to zero as they wish. As they decrease Pa, N 
will increase, and the number of opportunities they get 
to characterize the channel will increase, but the number 



of opportunities that Eve expects to get to obtain the 
message will not increase beyond — 21og(l — Cm)- 

Now that we have given a description of this protocol, 
two parts remain to the analysis: First, to describe pos- 
sible eavesdropping strategies and quantify the amount 
of information Eve expects to gain from her actions. Sec- 
ond, to show how Bob can place a bound on the Eve's 
expected information from his statistical error analysis. 

Due to the fact that Bob has a 1/4 chance to produce 
any of the four possible initial states p^'^\ p^^\ p^~^\ and 
Eve's best description of the initial state of the par- 
ticle — on every shot — is p = where / is the identity 
operator. An eavesdropper's goal is to choose her actions 
so that her description of the state of the particle is im- 
proved. This will lead to a better prediction of Alice's 
measurement results which will in turn allow her to de- 
duce the message from Alice's announcements. 

On each shot, an eavesdropper has only two options: 
either apply a quantum operation £ to the particle or 
perform a measurement (POVM) Ai on the particle. Ei- 
ther option will generally change the state of the particle 
(according to Eve's description). A quantum operation 
is described by a set of operators {Ei, E2, ■ ■ ■ , E,-} with 
the constraint EjEi = I. When applying a quantum 
operation to a particle described by the state p, the fi- 
nal state is described by p' = Yli ^iP^i ■ Similarly, a 
measurement with d possible outcomes is described by a 
set of operators {Fi, F2, - . - , F^} subject to the constraint 
F^ Fi = I. When the measurement is performed on 
the particle described by state p and the outcome i is 
found, the state after the measurement is then described 
by p' = F,pF} /Tt{F,pF}). Generally, we describe the 
mapping 11 from the initial state of the particle p to its 
final state n(p) = p' as the effective- evolution of the state 
of the particle on that shot. 

Over the course of the A'' shots, we describe 
the eff'ective-evolution string of length N as S = 
(ni,n2, . . . ,njv) where Ilj is the effective-evolution 
which occurred on the i*^ shot. It can be shown that for 
the qubit case at hand, the set of all possible effective- 
evolution strings of length is a compact set. 

Generally, the particular effective-evolution that oc- 
curs on a given shot is decided randomly. (Especially in 
the case when an effective-evolution occurs as a result 
of measurement.) Therefore, the a priori description of 
an eavesdropper's effect on the state of the particle will 
be through a set of possible effective-evolution strings 
of length A'', along with the probability Pr(<Si) that the 
string Si will be the one that occurs. 

To describe how much of the message an eavesdrop- 
per expects to obtain by imposing a particular effective- 
evolution string on the particle, we use the mutual infor- 
mation between the random variable B describing all the 
possible messages and the random variable A describing 
all the possible announcement strings. 
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TABLE II: The probability for the eight possible announce- 
ments given a particular value for b and given that an eaves- 
dropper causes the state to change from p to p' — n(p). For 

Eve, the initial state is always described by p = ij whereas 
Bob's description of the initial state is based upon his knowl- 
edge of the particular pure state he prepared on that shot. 



Pr(fTi,c = 

Pr(cri,c = 
Pr(a3,c = 

Pr(fT3,C = 

Pr((Ti, m = 
Pr(o-i, m = 
Pr(cr3, m, = 
Pr((T:i. ;;/ = 



=o|n,p,6) 

:i|n,p,6) 
=o|n,p,6) 
= i|n,p,6) 

+i|n,p,6) 
-i|n,p,6) 
+i|n.p,6) 

-i\n,p.h) 



^[l + (l-26)Tt(aip')] 

^[l-(l-2b)Tr(aip')] 
^[l + (l-26)Tr(a3p')] 
^[l-(l-26)TV(cT3p')] 
i^[l + Tr(aip')] 
-[l-Tr(aip')] 
-[l + Tr(a,p')] 
[1 - Ti(a,p')] 
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The possible messages are 6 = and b = l, both with 
a priori probability one-half. 

There are 8^ possible announcement strings, which 
comes from the eight possible announcements (shown 
in Table I) for each of the N shots. The probabil- 
ity Pr(a|6, <S) that Alice makes the announcement-string 
a = (ai, . . . , ojv) given a particular value of b and given 
that Eve's actions result in the effective-evolution string 

<s = (ni,...,nAr) is 



N 



Pr(al6,>S) = []Pr(a,16,n,) . 



(3) 



The probabilities for the eight different announcements 
on each shot are shown in Table II. 

The mutual information Is ( A : B) between ran- 
dom variables A and B describes the amount of knowl- 
edge (on average) Eve expects to gain about the mes- 
sage from Alice's announcements when she imposes 
the effective-evolution string <S. It is calculated by 



Is{A:B)=^ Pr(6) ^ Pr(a|6, S) log Pr(a|6, S) 

at") 

Pr(a|<S)logPr(a|<S) 



6=0 



-E 



(4) 



where the sum over a^^^ indicates that the sum is taken 
over possible announcement strings of length A'^, and 
where Pr(a|5) = i[Pr(a|6 = 0,<S) -hPr(a|6=l,<S)]. 

Each possible announcement string a can be "split- 
up" into X, the string of the bit- announcements in a, 
and y, the string of the result-announcements in a. The 
probability Pr(a|6, 5) can be written as 



Pr(a|6, S) = Pr(x|6, T) Pr(y|6, U) 



(5) 



where T is the effective-evolution string for the shots 
when bit-announcements are made and where U is 
the effective-evolution string for the shots when result- 
announcements are made. 

Because of the probabilistic nature of the protocol, the 
number of bit-announcements is not fixed. The probabil- 
ity Pr(fc) that Alice makes k bit- announcements can be 
calculated using the binomial distribution: 



Pr(fc) 



A^! 



k\{N -k)\ 



p^(l-pj(^-'=) 



where fc = 0, 1, . . . , AT. In other words, this is the prob- 
ability that the string x will have length k. The k bit- 
announcements can be distributed among the A^ shots 
in = fci^j^lfc); different ways. Since Eve does not 
know before-hand which shots will correspond to bit- 
announcements, when calculating the mutual informa- 
tion she must take into account that T can be chosen in 
(^) ways from the effective-evolutions in S. 
Utilizing these results, we rewrite Equation (4) as 



J 



/5(A:B) = ^i^Pr(fc)^^^ ^ Pr(x|6,r)Pr(y|&,iY)log[Pr(x|6,T)Pr(y|6,ZY)] 

6=0 k rC") Vfc/ xC*) yC-'') 

k TC') ^k) xC') y(w-fe) 

I 



where the sum over x^^^ (y*-^"*^-*) indicates that the 
sum is taken over possible bit- announcement (result- 
announcement) strings of length k (respectively, [N — k]) 
and where the sum over T^*'' indicates that this 
sum is taken over all possible ways in which the 
effective-evolution string of length k (corresponding to 



bit-announcements) can be chosen from the effective- 
evolution string S. The effective-evolution string U is the 
resulting effective-evolution string of length N — k when 
the string T is "plucked-out" of the string S. Because the 
result-announcements have no dependence on the mes- 
sage, neither do the result- announcement strings. That 
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IS, 



Pr(y|6 = 0,Z^) = Pr(y|6=l,W) = Pv{y\U) , 



for every U. It is straightforward to show that this results 
in a great simplification of Equation (6) to 



Is {A : B) 

Pr(fc) 

(N\ 

k V fe/ rC') L 6=0 

-^Pr(x|r)logPr(x|r) 



(7) 



This leads to the natural introduction of + 1 new 
random variables, X^'''> for fc = 0, 1, . . . , A/', where X^'''> 
describes the possible bit-announcement strings of length 
k. We can now rewrite Equation (7) as 



JV 



Is{A : B) = Y^p^il - ^^(^^'' ■■ ^) ■ (8) 



fe=0 



This completes the analysis of the amount of information 
that an eavesdropper expects to gain about the message 
when her eavesdropping activity induces the effective- 
evolution string S. 

It is worthwhile mentioning here that using Eqs. (8) 
and (3) we can now provide quantitative support for our 
earlier comment about the ignorance of an eavesdrop- 
per who is listening to Alice's announcements but not 
interacting with the particle in any way. In this case, 
the effective-evolution mapping 11 is the identity map- 
ping on every shot. Therefore, it is straightforward to 
show that Is{A : B) = Q because the probabilities for 
the bit-announcements (shown in Table II) do not de- 
pend on b. 

After the A'' shots are performed, Alice will have made 
a specific string of announcements a, which eorrc;sponds 
to specific strings of bit-announcements x (of length k) 
and result-announcements y. For each of the announce- 
ments (Zi, Bob knows the state pi in which he prepared the 
particle. As discussed earlier, houses this knowledge of 
the initial states, along with the k bit-announcements 
for a = 1 , . . . , fc to determine the message. We will now 
describe how he uses Alice's N — k result- announcements 
yp ior (3 — 1, . . . ,{N — k) along with his knowledge of the 
corresponding initial states p/j for /? = 1, . . . , (A' — fc) to 
determine the likelihood that the message was exposed to 
an eavesdropper. We describe this string of initial states 
by p = {pi,p2, . ■ . , Pjy_'^)j which corresponds to the shots 
where Alice makes result-announcements. 

Given an effective-evolution string S that Eve in- 
duces by her actions, k of these actions will have oc- 
curred on shots when Alice makes a bit-announcement 
and N — k occurred on shots when Alice makes a 



result- announcement. We can calculate Pr(y|5, p) the 
probability (from Bob's point of view) of Alice making 
the result- announcements y given the effective-evolution 
string S induced by Eve's actions. To do this, we use the 
string U = {IIi, . . . of effective evolutions in S 

that occurred during shots when a result- announcement 
was made. This probability is determined using 



N-k 



Pr(y|5,p) = [] Pr(ai|n„p,) . 



(9) 



We now form a set of effective-evolution strings S(e) such 
that S is an element of T,[e) if Pr(y| <S,p) > e for some 
number < e < 1. That is, we include an effective- 
evolution string in the set 5](£) if there is a substantial 
probability, based upon the result-announcement data, 
that that effective-evolution string was induced by an 
eavesdropper. 

We define the exposure Ie{£) of the message to be 

lE{e) = max ^ /r(xW : B). (10) 

This maximum is known to exist because E(£) is a com- 
pact set. This completes the analysis describing how the 
receiver sets a bound on the amount of a message exposed 
to any eavesdroppers. 

While using this protocol to transmit messages, if some 
messages have been transmitted with no exposure to 
eavesdroppers, these messages could be used as crypto- 
keys for subsequent communication. Finally, we remark 
that the states and measurements described here are 
identical to those used in the BB84 protocol, [6] and any 
apparatus that is designed to implement BB84 can also 
implement this protocol with minor modifications. 
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